# Role-Based Access Control (RBAC)

## Overview

Access to log data for users is managed by namespace controls. To learn more about what namespaces are in the Apica Ascent product, please refer to the section on namespaces [here](https://docs.apica.io/~/revisions/iBqtD6vFwTjCeuXOvwAa/observe/logs-terminology#namespace). Log data from a single namespace can contain multiple application logs. If a user has access to a namespace, the user can view logs for all applications in the namespace.

## UI Controls

When a user has restricted access to select namespaces, the UI will show only the namespaces the user can access for Logs, Search, and Events. In the example below, the user has restricted access to only 2 namespaces; `flash:advertise` and `prod-k8s:kube-system`

![](https://2948796384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LmzGprckLqwd5v6bs6m%2Fuploads%2FUbZKLP8cTLCzQLeXwZ49%2FScreenshot%20from%202022-07-04%2016-16-00.png?alt=media\&token=ad889897-4a57-40f9-a674-fcfe01398cda)

## apicactl Controls

Apica Ascent's CLI provides a similar restriction when a user tries to access resources under Role-based access controls. In the example below, the same user can be seen to only access the same namespaces;`flash:advertise` and `prod-k8s:kube-system`

![](https://2948796384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LmzGprckLqwd5v6bs6m%2Fuploads%2FZnqc0cqSKDYcij8edKuw%2FScreenshot%20from%202022-07-04%2016-18-31.png?alt=media\&token=28c43fe9-7591-47b4-8d17-200394273028)
